Filtered by vendor Archiver Project Subscriptions
Filtered by product Archiver Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-1002207 1 Archiver Project 1 Archiver 2024-09-16 N/A
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CVE-2019-10743 1 Archiver Project 1 Archiver 2024-08-04 5.5 Medium
All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.